T1609 Container Administration Command
Adversaries may abuse a container administration service to execute commands within a container. A container administration service such as the Docker daemon, the Kubernetes API server, or the kubelet may allow remote management of containers within an environment.(Citation: Docker Daemon CLI)(Citation: Kubernetes API)(Citation: Kubernetes Kubelet) In Docker, adversaries may specify an…
Who uses it · with stories on Jábega
Sigma rules to hunt it
- Potential Remote Command Execution In Pod Containermediumtest · kubernetes
- Potential Sidecar Injection Into Running Deploymentmediumtest · kubernetes
- Kubernetes Potential Enumeration Activitymediumexperimental · kubernetes
Rules from SigmaHQ · Detection Rule License 1.1. Technique from MITRE ATT&CK®.